Pi: a path identification mechanism to defend against DDoS attacks

By Abraham Yaar, Adrian Perrig, Dawn Song. 2003 Symposium on Security and Privacy, 2003., 2003

485 citations recorded by the source corpus.

Distributed denial of service (DDoS) attacks continue to plague the Internet. Defense against these attacks is complicated by spoofed source IP addresses, which make it difficult to determine a packet's true origin. We propose Pi (short for path identifier), a new packet marking approach in which a path fingerprint is embedded in each packet, enabling a victim to identify packets traversing the same paths through the Internet on a per packet basis, regardless of source IP address spoofing. Pi features many unique properties. It is a per-packet deterministic mechanism: each packet traveling along the same path carries the same identifier This allows the victim to take a proactive role in defending against a DDoS attack by using the Pi mark to filter out packets matching the attackers' identifiers on a per packet basis. The Pi scheme performs well under large-scale DDoS attacks consisting of thousands of attackers, and is effective even when only half the routers in the Internet participate in packet marking. Pi marking and filtering are both extremely lightweight and require negligible state. We use traceroute maps of real Internet topologies (e.g. CAIDA's Skitter (2000) and Burch and Cheswick's Internet Map (1999, 2002)) to simulate DDoS attacks and validate our design.

Subfields: Artificial Intelligence, Computer Networks and Communications, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/4f7079f796ec01989d8ae3f60fe4c3b388b19570

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Hardware and Architecture

Citations in the corpus

Hop-count filtering: an effective defense against spoofed DDoS traffic (2003, background): “Based on IP traceback marking, Path Identifier (Pi) [45] embeds a path fingerprint in each packet so that a victim can identify all packets traversing the same path across the Internet, even for those with spoofed IP addresses.”
A Survey of Man In The Middle Attacks (2016, background): “3) Host and Router Based Solutions: Stack Path identifier (Pi) [130] is a reactive scheme, where each router uses IP identification field for marking.”
SIFF: a stateless Internet flow filter to mitigate DDoS flooding attacks (2004, methodology): “In earlier work, we propose the Pi marking scheme to enable the victim to detect packets with a spoofed source IP address [ 47 ].”
Amplification Hell: Revisiting Network Protocols for DDoS Abuse (2014, background): “propose to detect DDoS traffic by tracing back the routes IP packets have taken [41].”
Cyber security in the Smart Grid: Survey and challenges (2013, background): “…flooding [35] Transport layer Buffer flooding [36] MAC layer ARP spoofing [37] Physical layer Jamming in substations [38] W. Wang, Z. Lu / Computer Networks 57 (2013) 1344–1371 1349 performance, such as distributed traffic flooding and worm propagation attacks on the Internet [47] [48] [49].”
A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks (2013, methodology): “, Ingress/Egress [55], History-based IP filtering [73], hop-count filtering [74], Pi [76], route-based packet filtering [79], [80], etc.”
A DoS-limiting network architecture (2005, methodology): “Researchers have advocated filtering to prevent th use of spoofed source addresses [8], traceback to locate the sourc e f the disrupting packets [21, 23, 22, 25], overlay-based filterin g [12, 1, 14] to protect approaches to servers, pushback of traffic filt ers into the network [16, 10, 3], address”
/*icomment: bugs or bad comments?*/ (2007, result): “Similar to previous studies using machine learning techniques [28, 43], we divide manually labeled comments into two groups, one used for training, the other used for testing to automatically measure the accuracy of our trained rule generators.”
Change-point monitoring for the detection of DoS attacks (2004, background): “In parallel with these, many defense mechanisms have been installed at victim servers or their proximate firewalls to withstand DoS attacks, such as Client Puzzle [27], [59], Defensive Programming [44], Escort [52], Hopcount Filtering (HCF) [26], Path identifier (Pi) [60], Syn cache [32], Syn cookie”
Edge Computing Security: State of the Art and Challenges (2019, background): “[28] proposed a mechanism to spot DDoS on a per-packet basis.”
Defense Against Spoofed IP Traffic Using Hop-Count Filtering (2007, background): “As a proactive solution to DDoS attack s, these filtering schemes [15], [29], [36], [55], which must ex ecute on IP routers or rely on routers’ markings, have been propose d to prevent spoofed IP packets from reaching intended victim s.”
Botz-4-sale: surviving organized DDoS attacks that mimic flash crowds (2005, background): “Many variations to the traceback idea to detect sneak attacks cheaply exist [7, 44, 53].”